* That's covered in `verify a template without variables can be rendered`, I'll add one for an empty template as well
* I think it might be safer to replace unmatched variables with an empty string as there can be times where not all the metadata has been returned?
* Definitely not for Shib and I haven't seen it in any of the other auth providers so far